基于时间自动机Ad hoc网络入侵检测(电子与信息学报)出版.pdfVIP

第 31 卷第 10 期 电 子 与 信 息 学 报 Vol.31No.10 2009 年 10 月 Journal of Electronics Information Technology Oct. 2009 基于时间自动机的 Ad hoc 网络入侵检测 易 平①② 柳 宁① 吴 越① ①(上海交通大学信息安全工程学院 上海 200030) ②(东南大学儿童发展与学习科学教育部重点实验室 南京 210096) 摘 要：该文提出一种基于时间自动机分布式合作的入侵检测算法。首先，将整个网络分为子区域，每一区域随机 选出簇头担任监视节点，负责本区域的入侵检测。其次，按照路由协议构筑节点正常行为和入侵行为的时间自动机， 监视节点收集其邻居节点的行为信息，利用时间自动机分析节点的行为，识别入侵者。该算法不需要事先进行数据 训练并能够实时检测入侵行为。最后，通过模拟实验证实了算法的有效性。 关键词：移动 Ad hoc 网络；路由协议；网络安全；入侵检测；时间自动机 中图分类号：TP393 文献标识码： A 文章编号：1009-5896(2009)10-2310-06 Intrusion Detection Based Timed Automata for Ad hoc Networks ①② ① ① Yi Ping Liu Ning Wu Yue ① (School of Information Security Engineering, Shanghai Jiao Tong University, Shanghai 200030, China) ② (Key Laboratory of Child Development and Learning Science of Ministry of Education, Southeast University, Nanjing 210096, China) Abstract: In this paper, a distributed intrusion detection approach is proposed based on timed automata. A cluster-based detection scheme is presented, where periodically a node is elected as the monitor node for a cluster. These monitor nodes can not only make local intrusion detection decisions, but also cooperatively take part in global intrusion detection. And then the timed automata is constructed by the way of manually abstracting the correct behaviours of the node according to the routing protocol of Dynamic Source Routing (DSR). The monitor nodes can verify every node’s behaviour by timed automata, and validly detect real-time attacks without signatures of intrusion or trained data. Comp